SOC Analyst, Level 3 (Senior)

SOC Analyst, Level 3 (Senior)

Location: Irving, TX (Onsite) | Contract

Hands-on Splunk coding experience (SPL detection rules, correlation searches, and alert scripting) is required for this role.

Overview

Our client's Cyber Defense Operations team is seeking a senior Level 3 SOC Analyst to lead complex investigations and build detections in Splunk. What sets this role apart from Level 2 is required coding experience in Splunk, including detection rules, alert scripting, and detection engineering. You'll work a regular US daytime shift alongside the US SOC team, including Level 2 analysts, and an offshore global support team.

Responsibilities

• Design, write, and maintain Splunk detection rules and correlation searches (SPL) based on threat intelligence and attack techniques.
• Script, configure, and tune Splunk alerts to raise detection fidelity and reduce false positives.
• Lead investigation and response for complex and high-severity incidents escalated from Level 2 analysts.
• Perform threat hunting across Splunk data to find activity that existing alerts miss.
• Integrate new log sources and security tools into Splunk, and validate data quality for detection use.
• Mentor Level 2 analysts and review their incident handling, and own runbooks and detection documentation.
• Coordinate with the offshore global support team on handoffs, escalations, and detection changes.

Required Qualifications

• 5-8 years of experience in SOC, incident response, or detection engineering roles, including senior-level incident handling
• Coding experience in Splunk: writing detection rules and correlation searches in SPL, and Splunk alert scripting
• Hands-on detection engineering: building, testing, and tuning alerts end to end
• Deep knowledge of attack techniques (e.g., MITRE ATT&CK), networking, and Windows and Linux internals
• Proven ability to lead incidents and explain findings to technical and non-technical audiences
• Ability to work onsite in Irving, TX on a regular US daytime schedule

Preferred Qualifications

• Splunk Enterprise Security experience; Splunk Core Certified Power User or Splunk Certified Cybersecurity Defense Analyst
• General scripting (Python, PowerShell) for automation and enrichment
• Advanced certifications such as GCIH, GCIA, DA
• Experience with SOAR, EDR, and cloud security tooling integrated into Splunk
• Retail or large multi-site enterprise experience

Pay rate: $60-65/hr (W2). This is a 6-month contract position, onsite in Irving, TX.